Quantum and Classical Noise in Practical Quantum Cryptography Systems based on 

polarization-entangled photons 
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Quantum-cryptography key distribution (QCKD) experiments have been recently reported using 
polarization-entangled photons. However, in any practical realization, quantum systems suffer from 
either unwanted or induced interactions with the environment and the quantum measurement sys- 
tem, showing up as quantum and, ultimately, statistical noise. In this paper, we investigate how 
ideal polarization entanglement in spontaneous parametric downconversion (SPDC) suffers quantum 
noise in its practical implementation as a secure quantum system, yielding errors in the transmitted 
bit sequence. Because all SPDC-based QCKD schemes rely on the measurement of coincidence to 
assert the bit transmission between the two parties, we bundle up the overall quantum and statis- 
tical noise in an exhaustive model to calculate the accidental coincidences. This model predicts the 
quantum-bit error rate and the sifted key and allows comparisons between different security criteria 
of the hitherto proposed QCKD protocols, resulting in an objective assessment of performances and 
advantages of different systems. 

PACS numbers: 03.67.Dd, 03.65.Yz, 03.65.Ud, 42.65.-k 



I. INTRODUCTION 

Quantum Cryptography Key Distribution (QCKD) is 
at the moment the most advanced and challenging appli- 
cation of quantum information. QCKD offers the possi- 
bility that two remote parties, sender and receiver (con- 
ventionally called Alice and Bob), can exchange a secret 
random key, called sifted key (string of qubits), to im- 
plement a secure encryption/decryption algorithm based 
on a shared secret key, without the need that the two 
parties meet [1-3]. 

In practical QCKD, Alice and Bob use a quantum 
channel, along which sequences of signals are either sent 
or measured at random between different bases of or- 
thogonal quantum states. Alice can play the role of ei- 
ther setting randomly the polarization basis of photons 
and sending them to Bob (faint laser pulses as photon 
source), or measuring photons randomly in any one of 
the selected bases (entangled photon source). Bob, ran- 
domly and independently from Alice, measures in one 
of the bases. The sifted key consists of the subset of 
measurements performed when Alice's and Bob's bases 
are in an agreed configuration according to the proto- 
col used, obtaining at this point a deterministic outcome 
whose security relies on the laws of quantum physics, for 
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they previously agreed upon the correspondence between 
counting a photon in a specific state and the bit values 
or 1. In contrast, the security of conventional cryptog- 
raphy relies upon the unproven difficulty in factorizing 
large numbers into prime numbers by a conventional al- 
gorithm. We note that there is no guarantee that such 
an algorithm does not exist. 

The underlying feature of QCKD, namely the reliance 
of the security of the distributed secret key on the laws 
of quantum physics [1-3] , gives it an advantage over the 
public key cryptography. In other words, the uncer- 
tainty principle prohibits one from gaining information 
from a quantum channel without disturbing it. Basi- 
cally, QCKD is founded on the principle that when a 
third party (Eve) performs a measurement on a qubit 
exchanged, she induces a perturbation, yielding errors 
in the bit sequence transmitted, revealing her presence. 
Any attempt by Eve to obtain information about the key 
leads to a nonzero error rate in the generated sifted key. 
Nevertheless this last claim must be somewhat softened 
because of practical realization of quantum channels [4] . 
Unfortunately, in practical systems, errors also happen 
because of experimental leakage, like losses in optics, de- 
tection, electronics and noise. Also, even when no eaves- 
dropper is disturbing the bit exchange, there will be er- 
rors in the transmission and Alice's and Bob's strings will 
not coincide perfectly. Thus in practice there is no way 
to distinguish an eavesdropper attack from experimental 
imperfections, making it necessary to establish an upper 
bound on tolerable experimental imperfections in the re- 
alization of the quantum channels to implement an error 
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correction procedure. 

Following the first proposal by Bennett and Bras- 
sard [1] and later the Ekert protocol invoking entangled 
states [2], various systems of QCKD have been imple- 
mented and tested by groups around the world. Re- 
cently some research groups [5-9] performed the first 
QCKD experiments based on polarization-entangled pho- 
ton pairs, and Brassard et al. [4] proved theoretically that 
QCKD schemes based on spontaneous parametric down- 
conversion (SPDC) offer enhanced performance, mostly 
in terms of security, compared to QCKD based on weak 
coherent pulses. 

Entangled photons, generated by SPDC in nonlinear 
crystals, have proved largely successful for quantum op- 
tical communication [10-13] and quantum radiomctry 
[14-23]. Furthermore, basic experimental tests of the 
foundation of quantum mechanics had been performed 
by exploiting the entanglement of this source [24-26]. 
However, quantum noise in a SPDC quantum state may 
significantly limit performance of the proposed quantum 
optical communication and information technologies. 

In this paper we provide a general model for an a 
priori evaluation of some crucial parameters of a gen- 
eral QCKD scheme based on polarization entangled pho- 
tons. We basically adopt the formalism of quantum op- 
erations [27] to describe the dynamics of an open quan- 
tum system subject either to the interactions with the 
environment or to a quantum device performing a mea- 
surement on it. These unwanted or induced interac- 
tions show up as noise in quantum-information process- 
ing systems, degrading their ideal performance. Exploit- 
ing the quantum-operation formalism we present a model 
to quantify precisely both quantum and ultimately sta- 
tistical noise in quantum-information experiments per- 
formed using an entangled photon source. 

In Section II we consider quantum noise in a lossless 
measurement system where noise is due to the coupling 
between the polarization mode of the source with the po- 
larizing beam splitter ports. In Section III we discuss the 
case of a lossy system, where noise is induced by detec- 
tion deficiencies, such as losses of correlated photons from 
the presence of optical elements, non-ideal detectors, and 
electronic devices in either channel, and detector dark- 
counts. 

The model concludes with the calculation of an overall 
probability of total coincidence counts, including an im- 
perfect time-correlation measurement, ultimately yield- 
ing an estimate of accidental coincidences (Section IV). 

This result is used in the calculation of the quantum bit 
error rate (QBER) for QCKD protocols, i.e., BB84 and 
the two variants of the Ekert's protocol, based on CHSH 
and Wigner's inequalities respectively (Section V). Pre- 
visions are also presented about the sifted and the cor- 
rected key, the quantum-bit error rate (QBER) before 
and after a standard error correction procedure. Finally 
we evaluate the performance of security criteria for Ek- 
ert's protocols based on both the CHSH inequality and 
Wigner's inequality (Section VI). 




FIG. 1: QCKD set-up: polarization-entangled photons gen- 
erated by SPDC are directed to the two parties (Alice and 
Bob). The bit sequence of the key is obtained by means of 
polarization-sensitive synchronized measurements performed 
by Alice and Bob according to a specific QCKD protocol. 



II. QUANTUM NOISE IN POLARIZATION 
SELECTION OF PHOTON PAIRS 

In this Section we consider a real either non-maximally 
entangled or partially mixed state resulting from both 
imperfect entangled state generation by SPDC and im- 
perfect polarization state selection by real polarizing 
beam splitters (PBSs). 

In Fig. 1 we depict the typical scheme for quantum 
cryptography key distribution as implemented using en- 
tangled photons generated by SPDC. Because of a non- 
linear interaction in a \ crystal, some pump photons 
(angular frequency lo p ) spontaneously split into a lower- 
frequency pair of photons, historically called signal and 
idler, perfectly correlated in all aspects of their state 
(direction, energy, polarization, under the constraints of 
conservation of energy and wavevector momentum, oth- 
erwise known as phase- matching) . These entangled states 
show perfect correlation for polarization measured along 
orthogonal but arbitrary axes. 

The QCKD performed by pure entangled states re- 
lies on the realization of two quantum correlated optical 
channels. These channels yield single-photon polariza- 
tion states, such that whenever Alice performs a polariza- 
tion measurement on a photon of the pair, automatically 
the other photon is projected in a defined polarization 
state, i.e., Alice plays the role of triggering Bob's mea- 
surement. In actuality, the light field emerging from the 
output of the nonlinear crystal is a polarization-entangled 
multimode state. However, it can be described as a po- 
larization entangled two-photon state in only two effec- 
tive modes (one for channel a and the other for chan- 
nel b), as signal and idler pairs can be easily emitted 
non-collinearly with the pump by proper phase-matching 
rules [28]. This scheme eventually is exploited in quan- 
tum information applications by using one channel as the 
trigger or reference (a) and the other channel as the probe 



3 



(b). According to Fig. 1, we denote Alice's detector ap- 
paratus to be the trigger and Bob's to be the probe. Al- 
ice and Bob detection apparatus consist of polarization- 
analyzer systems (PAS) for proper single-beam polariza- 
tion rotation, polarizing beam splitters (PBS), photon 
detectors (l a , 2 a , l b , 2 b ), data storage systems (comput- 
ers) and synchronization systems. 

Let us consider in the following type II SPDC entan- 
gled states [29], where the output two-photon states are 
a quantum superposition of orthogonally polarized pho- 
tons, i.e. the singlet state [30]: 
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\H a ) \V b ) - \Va) \H b )) . 



Practically, pure entanglement may not be achieved 
because of imperfect source generation and because of 
incomplete entangled photon collection. According to 
Refs. [31, 32] an uncompensated for coherence loss, in- 
duced in the state by the coupling between polarization 
and frequency modes because of a bircfringent environ- 
ment, may produce a partially mixed or non-maximally 
entangled state. Also the collection of the same number 
of entangled photons on both channels is unlikely, mostly 
due to the imperfect positioning of the detection systems 
along the true directions of entangled photons on the 
SPDC cones. Two complex variables, ( (|£| ^ 1) and 
e, characterize the imperfect compensation of dephas- 
ing and decoherence in the crystal and the misalignment 
in collecting entangled photons in the optical paths, rc- 
spectevely. The net result is a non-maximally entangled, 
or partially mixed state, written as 
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2 \V a )\H h ) (H b \(V a \ + 
(e()*\H a )\V b ) (H b \ 04| 



We analyze now the quantum noise introduced via 
an imperfect polarization state selection by the PBSs 
depicted in Fig. 1. Here, the entangled pho- 
tons are detected accordingly to their polarizations 
by using imperfect polarizing beam splitters (PBSs) 
on both arms and perfect single-photon detectors. 
The PBSs project photons onto a polarization basis 
{\H a ) \H b ) , |K) |K) , \H a ) |K) , |K) \H b )}, while the po- 
larization analyzer systems (PASs) induce the transfor- 
mations represented by the unitary operators T z in each 
arm (z = a, b), according to 

f z \H z ) = Cl \H z )+c 2 \V z ), 

f z |K) = c 2 \H Z ) - Cl |K) • 

In the case of ideal PBSs, channel z transmits state 
\H a ) (\H b )) and reflects state |K) (|K))> i-e., there is a 
perfect coupling between the output ports of the PBSs 
and the projections of the photon polarization state. 
In the approach so far adopted in the literature a per- 
fect coupling is always assumed because the measure- 
ment process is considered as a projection on polarization 



12 



71 Ol 

\02 



\ H °w)\° 2 ) 



v t 



K4 01 ) 



v „m)\° 2 ) 



FIG. 2: Real PBS: all photons projected in K(&)) polarized 
state should be reflected, but some of these are wrongly trans- 
mitted. Moreover all photons projected in \H a ^) polarized 
state should be transmitted, but some of these are erroneously 
reflected. 



states \H a ) , \V a ), \H b ) , \V b ) , thus assuming detectors 
l a , lb, 2 a , 2 b , are sensitive to polarization. Here we con- 
sider a further noise effect induced by the presence of real 
PBSs, where a small part of the photons projected onto 
|K) (|K)) are erroneously transmitted, and some pho- 
tons projected in the state \H a ) {\H b }) are erroneously 
reflected (generally less than 2 % and 5 %, respectively), 
as shown in Fig. 2. For this purpose, we extend the 
Hilbert space to describe these photon states as 

\H Z )\01 Z ) = t z \H z )\Il z )+r z \H z )\I2 z ) 

\H Z )\02 Z ) = t z \H z )\I2 z )+r z \H z )\Il z ) 

|K) \Ol z ) = ri |K) \I2 Z ) + tj |K) \H Z ) 

|K) \02 z ) = rj |K) \H Z ) + tjr |K) \I2 X ) , (1) 

where \Ox z ) represents the photon crossing the output 
port of the PBS towards detector x z and \Ix z ) repre- 
sents the photon crossing the input port of the PBS, 
with x = 1,2. is the transmittance of photons 

in the |K) polarization state, and |r^"| = 1— |^| 2 is 
the corresponding reflectance, whose phase relation is 
rjr/tj: = i\r^r\ / \tjr\. Analogously, \t z ^ and \r z \ 2 are 
the transmittance and reflectance of photons in the \H Z ) 
state. So far, we have considered only lossless PBSs. The 
effect of photon losses due to all optical devices used in 
the channels are treated in Sections III and IV. 

We dehne the input density matrix for the PBS ports 



as 



-PBS 



|/l )|/l t ) </l 6 |<Jl | 



and the total input density matrix p* n of the photon sys- 
tem as 



-PBS 



The formalism of quantum operation is the most suit- 
able to describe the evolution of a quantum system cou- 
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pled with another quantum system or with the environ- 
ment, as well as the evolution of a quantum system sub- 
ject to measurement [27]. In this context, we consider the 
set of non-trace-preserving quantum operations {£ XaVb } 
defined as 

ZxaVb (P^) = Tr PBS (PxaVb^-PBsS^S^U^p^P^y^ , 

describing the process of detection of the photon pair by 
the detectors x a and yb {x,y — 1,2). In this expression, 
the unitary operator describes the action of the PASs 
and the unitary transformation l^_pbs describes the cou- 
pling between the photon pair polarization state and the 
PBS ports. The explicit form of U^.pbs is deduced by 
Eq.s (1), and calculations are reported in Appendix A. 
Because the operators T a and Tj, independently act on 
the corresponding subspaces a and b of the Hilbert space 
of polarization and induce linear transformation, they are 
ineffective on the Hilbert space of the PBS ports. Thus, 
/?" is subject to a global transformation written as an 



unitary operator S$ 



i PBS, 



)S a ,b, where S a ,b = T a ®T b . 



p x a y b = \Ox a ) \Oy b ) (Oy b \ (Ox a \ is the projector rep- 
resenting the detection process by the two detectors x a 
and yb- The probability of detection of the photon pair 
by the detectors x a and y b is 



p{x a ,yb) = Tr^ [£ XaVb (jo*)] = 



The evolution of the system p" is evaluated according to 
the formalism of quantum operations. 

In this way, we define the set of non-trace-preserving 
quantum operations as {£&} as 

^ Go") = Tr E „ {P&U^F ® K) (eg| E% _ E/ p£t) , 

(4) 

which describes the detection of m photons by the system 
(i. In this expression the unitary operator Uq u .e„ repre- 
sents the interaction between the quantum system Q„ of 
photons in the channel v in the initial state and the 
lossy and noisy environment E^ in the initial state \e$). 
The action of Uq v .^^ on the state "number of photons" 



is 



U Q ,^ K) \4) = E d "K") Kn) (5) 



where |d M (m, n)\ 2 is the probability of measuring m pho- 
tons out of n present in the channel v because of losses. 

Pm = J2n= m I e m,n) (e&,„| are the measurement opera- 
tors. 

Thus, the probability of measuring m counts by the 
detection system \x is 

oo 

p„(m) = Tr Q „ [£* (?)] = £ p" nn K(m,n)| 2 (6) 

n—m 

where p u nn is the probability of having n photons on the 
channel v. 



^>x aVb £x aVb (jS*) is trace-preserving because the prob- 
abilities of the distinct outcomes sum to one, i.e., 

1 for all 



Tr 



Ex aVi , £ Xa1to (p^) = J2 XaVb P( X a,yb) 



possible input pr . 



III. QUANTUM AND CLASSICAL NOISE IN 
PHOTON COUNTS 



In the following we consider the noise contribution to 
the photon counts because of an imperfect collection of 
photons and a noisy and lossy detection system. For 
the experimental setup in Fig. 1, we calculate the total 
probability Ptot,x z (p) of n counts by any detector x z by 
separately calculating the probabilities of counts associ- 
ated with correlated photons (p sp ,x z i n )), with uncorre- 
cted photons (p u ,x z {n)), and with detector dark counts 
(Pd.xAn)). 

To describe the counting process we adopt the formal- 
ism of quantum operations, where we consider a general 
density matrix representing photons on a channel v in 
term of number of photons, i.e. {|n")} , as 



7 



= E Pnm\n v )(m v \ 



(3) 



A. Single counts associated with correlated 
photons 

In the following we concentrate primarily on the mea- 
surement of correlated photons by a lossy detector, x z . 
We define the density matrix of the number of photon 
pairs, pP, as 



7= E P P nm\n p )(m p \ 



(7) 



n,m— 



Analogous to Eq. (7), we write a density matrix of single 
photons of the pairs (sp) along channel z: 



F P ' Z = E P P n m \n sp ' z ) (m s 

n.ni— 



(8) 



n m— 



The counting of correlated photons on channel z by 
the detector x z is described by mapping on the 

set of non-trace-preserving quantum operation {£%P' X *}. 
The explicit form of £% P ' X * (p sp ' z ) is deduced by anal- 
ogy to Eq. (4), by replacing the interaction unitary 
operator with Uq sp z -e SPjXz and the measurement oper- 
ator with P^' Xz , given that Q sp _ z is the quantum sys- 
tem of single photons of the pair on the channel z and 
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E S p, Xz is the lossy and noisy environment in the ini- 
tial state \e 8 Q ,Xz ). The Uq bp z -E sp ^ z action on the state 
\n sp ' z ) is completely described by means of coefficients 
d sp,x * (m,n) in complete analogy with Eq. (5), while we 
have P s P> x z — V°° \ P S P, X A / P sp,x z I 

The probability of m counts by the detector x z corre- 
sponding to correlated photons becomes 



P SPA H=£ ff nn \d s ^(m,n)\ 2 . 



(9) 



The probability of n pairs is given by p p nn = 
(X p t) n exp(—X p t)/n\, t being the time of measurement 
and X p the mean rate of photon pairs in the Alice and 
Bob channels [21, 33-35]. The terms 



\d sp > Xa {m,n)Y 



\d sp ' y »{m,n)\ 2 = 



tx a ^2p(x a ,y b ) 

Vb 

Vb 

1_ Zvb^2p( x a,yb) 



are the probabilities that only m out of n photons in 
the channel a (b) are counted by the detector x a (j/b). 
Losses due to electronics (n z ), detection efficiencies (r] Xz ), 
as well as optical losses (t Xz ) are summed up in the term 
£ Xz = ~n z r\ Xz T Xz [22, 36]; while we refer to the Appendix B 
for the analysis of dead time in this context. The term t Xz 
incorporates all losses in the Alice and Bob optical path, 
such as from crystals, filters, lenses, PBSs, PASs and 
fibers. The terms ^, x r yb \ p( x a, Vb) are the probability 
that each photon of the pair may be counted randomly 
by any arbitrary detector (Eq. 2). Probability p sp , Xz (m) 
is derived according to Eq. (9), giving 



exp (-X sPiXz t) 



(10) 



with mean count rates given by 

^sp,x a — £x a ^ ' p(x a , yb) Xp, 

Vb 

^sp,Vb = £yb ^ ] p( x a7 Vb)^p- 



B. Single counts associated with uncorrelated 
photons and dark counts 

Here we consider counts from any detector x z from 
stray light, uncorrelated photons, and dark counts even- 
tually contributing to noise in the distributed key. The 



density matrix associated with stray light and uncorre- 
lated photons is 



-jju,x z 



n,m— 



n" 



'■) (m u ' x * 



By pursuing the same formalism as before the detection 
of uncorrelated photons by the detector x z is described 
by means of the set of non-trace-preserving quantum op- 
eration {£m X *} ■ The map £^ Xz (p 11 ^*) follows in anal- 
ogy with Eq. (4). The unitary operator Uq -E u Xz 
describes the interaction between the quantum system, 
Qu, Xz , of uncorrelated photons on the channel x z and the 
lossy environment, E u , Xz , m the initial state \eQ' x *}. The 
measurement operator is P% x * = J2n= m l e ™fn) <Cfn| ■ 
The action of Uq u x -e„ Xz on the state \n u ' Xz ) fol- 
lows from Eq. (5) with the decomposition coefficients, 
d u > x »(m,n). 

Thus, the probability of measuring m counts of uncor- 
related photons by the detector x z is 



Pu, Xz {m)= Pnn 



\d u > x *(m,n) 



(11) 



where p^„ z is the probability of n uncorrelated photons 
in the channel x z . According to Refs. [21, 33-35], we 
assume that we have p^ Xz = (X UiXz t) n exp (— X UtXz t) /n\, 
where X UiXz is the mean rate of uncorrelated photons. 
The term 



\d u ' x *(m,n)\' 



(k.ni-k.r 



is the probability of m out of n uncorrelated photons 
counted by the detector x z . 
The 

Pu,x z (n) derived accordingly from Eq. (11) is 



Pu,x z (n) = (^x z x u , Xz ty 



exp (-£ Xz X UtX J) 



(12) 



The main source of noise in detectors is due to dark 
counts, whose distribution is regarded merely from a sta- 
tistical point of view as the probability of n dark counts 



Pd, Xz {n) = (Xd,x z t)' 



exp(-X d , Xz t) 



with the mean dark-count rate being Xd,. 



C. Total counts 

As real counters cannot distinguish among counts due 
to correlated photons, counts due to uncorrelated pho- 
tons, and dark counts, the total probability of measur- 
ing k counts by detector x z is calculated according to 
[21, 33, 35], 

OO 

Ptot,x z 

(*)= E 5 « 

,J+m+n Psp,x z 

(l)Pu, Xz (m)p d . Xz (n), 

l,m,n—0 
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giving 



Ptot,x z (n) = ( A t ot,x 2 *)' 



exp(-A to t,x^) 



where the mean rate of total counts measured by the 



detector x z is A 



tot, £5 



Asp, £5 £,x z X u ,x z "i" ^d,x z • 



IV. 



COINCIDENCE COUNTS 



Probability p P , Xa y b (n) is derived according to Eq. (13), 
obtaining 



Pp,XaVb( n ) — (Ap,z j/ 6 i) 



exp {-X p>Xa y b t) 



p,XaVb — ix a iy b p{x a , yb)Xp is the mean rate of true 



where A : 

coincidences seen by the pair of detectors x a and yt- 



We build up a model for the probability Pc,x a y b 

(n) of 

measuring n coincidences by a pair of detectors x a and yb 
in order to estimate crucial quantities of a typical QCKD 
experiment, such as the sifted key and the QBER before 
and after the error correction procedure, whenever dif- 
ferent protocols are applied. We distinguish between the 
probability distribution of true coincidences (Pp,x a y b ( n )> 
due to correlated photons) and the probability distribu- 
tion of accidental coincidences (pAcc,x a y b (n), because of 
imperfections in the detection electronics). 

We consider the density matrix in terms of counted 
pair states (Eq. (7)), and we describe its evolution 
exploiting the formalism of quantum operations as de- 
scribed in Section IV by defining another set of non-trace- 
preserving quantum operations {£f^ XaVb } ■ 

£m XaVb (p^) describes the measurement of m coinci- 
dences originated by the detection of the two photons 
of a pair by the detectors x a , yb- Its explicit expression 
is found from Eq. (4), except for the interaction be- 
tween the quantum system Q p of photon pairs in the 
initial state fP and the lossy and noisy environment 
E P;Xa!/() in the initial state 
unitary operator t/ Qp _ EpiXaB6 
ator I*?-** = £~ ro V 
The action of Uq^ v , 
ton pairs" is 



e p l ' XaVb ) represented by the 
and the measurement oper- 



P,x a Vb 



■p,x a yb 



on the state "number of pho- 



,p,x a yb\ _ 



'0 



m=0 



Thus, the probability of measuring m true coincidences 
corresponding to photon pairs by the pair of detectors x a , 
Vb is 

OO 

Pp,x a y b (m) = J2 Pnn \d P ^ b {m,n)\ 2 . (13) 
n—ra 

Realizing that a true coincidence may occur only if 
both photons of the pair are not lost, we emphasize that 
the terms \d p ' XaVb (m, n)\ 2 are the probabilities that only 
m pairs are detected as coincidences by the pair of de- 
tectors x a , yb when n photons are present in the Alice's 
and Bob's channels. It is straightforward to deduce the 
explicit form of \d p ' XaVb (m,n)\ 2 as 



\d p > x " yb (m,n) 



m 



[txJy b p(Xa,yb)Y 



I 1 - tx a ty b P(x a ,yb)Y 



A. Accidental coincidences 



The presence of the temporal coincidence windows, 
during which coincidences are measured, modifies the 
mean total coincidence counts, thus forcing one to distin- 
guish between true and accidental coincidence statistics. 
We assume that true coincidences occur in the middle of 
the coincidence temporal window. Then we deduce the 
probability distribution of accidental coincidences and fi- 
nally the probability distribution of total coincidences, 
accounting for true and accidental coincidences, assum- 
ing w < D z , where D z is the dead time in the z channel 
according to Appendix B. 

We regard Pn,x z (n) as the probability distribution of 
photons counted by the detector x z that may contribute 
to accidental coincidences in the time interval At. By ob- 
serving that the probability distributions Ptot,x z ( n ) an d 
P P , XaVb (n) are Poisson, it is simple to demonstrate that 
we have 



PN.xJn) = (An,x z At) 



„ exp (-A N ,x 2 At) 



where A 

A. 



= A t 



- A 



P,XaVb- 



and A 



N,y & 



A 



tot, y b 



p,x a yb 



are the mean count rates possibly contributing 
to accidental coincidences from the detectors x a and y^, 
respectively. 

Let us denote by q Vb the probability that at least one 
photon in yb is counted in the coincidence window At = 
w 



EAt= 
PN.x 



'(n) = 1 - exp (-An^w) , 



(14) 



i=i 



because detectors x a are here considered as triggers. 

The term in Eq. (14) is intended to account for the 
contribution of single detectors yb- Because detectors yb 
are statistically independent, the probability that both 
detectors count a photon producing an accidental coinci- 
dence is qi b qi b . The final probability of accidental counts 
from detector yb is obtained by subtracting half the prob- 
ability that both detectors in Bob's channel count an ac- 
cidental photon, in formula 



ll b = 9u(l-^«2»). 



Q*2 b = gflO- 



(15) 
(16) 
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According to [21, 33-35], we calculate the probability 
distribution of accidental coincidences in the time mea- 
surement t by applying the discrete convolution between 
the Poisson distribution of "triggering" counts and the 
binomial distribution with parameter q* b , 



In other words, the QBER is given by total coinci- 
dence provided by those detectors "wrongly" firing in 
coincidence according to the chosen protocol. In fact the 
protocol establishes which pair of detectors should fire to 
contribute to the key. 



PAcc,x a y b 

(m) = Pn,x a (ri)By b (m,n) 

n—m 

with B Vb {m,n)=^^j (g*J m (1 - q* Vb ) n ~ m , giving 



PA 



cc,x a y b 



(n) — (XAcc,x aVl ,t) 



exp(-\Acc,x a y b t) 



with \Acc,x a y b = Qy b ^N,x a - 

Lastly the probability distribution of total coincidence 
counts Pc,x aVb (n) is obtained by 

oo 

Pc,x a y b {k) — ^ ' &k,m+n Pp.x a y b { m ) PAcc,x a y b (jl) 
m.n—0 

( , .xn dXp(-X^ Xayb t) 

— \ A c,x a yb l ) j , 

where the mean rate of total coincidence measured by an 
arbitrary pair of x a and yb detectors is 



A 



~a'y b ^P,x a yb + ^Acc,x a y b - (1^) 



To characterize a particular QCKD procedure we em- 
body the effect of the transformations T a and Tt on pho- 
ton polarization by the rotation matrices 



cos 9 Z sin 9 Z 
sin 9, — cos 6 



(18) 



We rewrite Eq. (17) in terms of the rotation angles 
6 ' a , 6b, induced by transformations T a and Tb on the po- 
larization state of photons, by replacing p(x a ,yb) with 
Ps a ,s b {x a ,yb), whose complete expression is in Appendix 
A. More specifically, the calculated mean coincident 
counts are made explicit in terms of angular settings 9 a 
and 9 b as X c . Xayb (9 a ,9 b )t. 



V. EVALUATION OF QBER 

To characterize a particular QCKD procedure and to 
assess its advantages, we evaluate particular quantities 
such as the QBER and the sifted key for different types 
of QCKD protocols so far experimentally implemented, 
i.e. BB84 protocol and Ekcrt's protocols based on CHSH 
and Wigner's inequalities, respectively. 

The QBER is a parameter for describing the signal 
quality in the transmission of the sifted key, defined as 
the relative frequency of errors induced by accidental co- 
incidences, i.e. the number of errors divided by the total 
size of the cryptographic sifted key (K) [35] . 



A. BB84 protocol 

Here we examine the BB84 protocol variant proposed 
for entangled states in rcf. [3]. Recall that Alice and 
Bob measure photons randomly and independently be- 
tween two bases of orthogonal quantum states. One basis 
corresponds to horizontal and vertical linear polarization 
(©), while the other to linear polarizations rotated by 45° 
(®). Only half of the photon pairs can contribute to the 
sifted key, as only the subset of measurements performed 
with the two analyzers in the same basis contributes. 

The sifted key is given by 



^BB84(^a) — /basis/: 



basis J setting 



E 

x a y b 



^c,x a y b (6a, 6 a ) + 

Ac,s.ifc(0a + 7r/4,0 o + 7r/4) 



(19) 
t, 



where /basis = 1/2 is the probability to measure in 
the right basis ((9 a , 9 a ) and (9 a + n/A, 9 a + 7r/4)), while 
/setting = 1/2 is the probability to measure in a particu- 
lar analyzer setting ((9 a ,9 a ) or (9 a + 7r/4, 9 a + 7r/4)). 

All detectors contribute to the sifted key K, but only 
coincidences between l a 2b and 2 a lb correspond to the ex- 
pected anticorrclation when measurements are performed 
in the same basis (9 a — 9b), while QBER contributions 
come from the coincidences between detectors l a lf, and 
2 a 2b (as it is clear from Eq.s (Al) in Appendix A). There- 
fore the QBERbb84 explicit formula is 



QBER BB84 (6> a )-- 



Ei=l,2 



tt/4, 9 a + tt/4) 



4K B B84(0a) 

(20) 

To test the behavior of QBER, we simulate a realistic 
experiment with parameters r\ Xa = i] Vb — 0.5 (quantum 
efficiency of the four detectors), T Xa = r Vb — 0.1 (trans- 



mittancc of the four channels), Xd,x 



Ad, 



Vb 



50 s~ 



(dark count rate of the four detectors), D a = Db = 100 
ns (total dead time of the Alice's and Bob's detection sys- 
tems), 9 a = and w = 4 ns. The entanglement param- 
eters are e = 0.95 and ( — 1, the correlation level in the 
Alice channel is a a = 0.25 (a a = X p /(X P + J2 Xa Au.xJ), 
and the correlated photon rate is X p = 700 KHz. 

In Fig. 3 we show the dependence of QBER versus 
the optical properties of real PBS, i.e. the transmittancc 
\t z \ and \tjr\ (z = a,b) for the states \H Z ) and \V Z ) re- 
spectively. Results show how strongly the QBER can be 
affected by the optical properties of PBSs, whose influ- 
ence has been neglected so far. 

In Fig. 4 the behavior of the QBER is presented ver- 
sus the level of correlation, a a , in the Alice channel and 
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B. Ekert's protocol 




FIG. 3: QBER for the BB84 protocol versus the PBS's coef- 
ficients \t z \ and \t~t\ . 



Ekert's protocol has the peculiarity of relying on the 
completeness of quantum mechanics for security. There- 
fore, the possible combined choices between Alice and 
Bob for analyzer settings split into three groups: the first 
for key distribution, the second containing the security 
proof, and the third garnering the discarded measure- 
ments. 

Here we consider two possible variants of Ekert's pro- 
tocol: the variant based on the Clauser-Horne-Shimony- 
Holt inequality (CHSH), similar to the one proposed in 
Rcf. [8], and the variant based on Wigner's inequality 
[7]- 




1. Ekert's protocol based on CHSH inequalities 

To increase the number of measurements devoted to 
the key distribution we consider the case where Alice 
and Bob measure randomly among four analyzer settings 
and use the CHSH inequality to test eavesdropping. In 
this scheme, Alice's choices for the analyzer settings are 
a = {0 a ,0 a + 7r/8,6> a + tt/4, 6 a + 3tt/8) and Bob's are 
b = (0 a + tt/8, 9 a + tt/4, 9 a + 3 tt/8, 9 a + tt/2). 

The key distribution is performed when Alice and 
Bob's settings are the same or orthogonal, so that the 
sifted key is 



FIG. 4: QBER for the BB84 protocol versus the correlation 
level in the Alice channel a a = X P /(X P + ^2 x X u ,x a ) and the 
correlated photon rate A p for two noise levels in the channels 
(At,/Aa = 1.2 and 3, where X a = X p + J2 Xa -V^a and ^f> = 



setting 



E 



^c,x a y b 



,(*« 



{e a ,e a + Tr/2)+ 



y c,x a y b \ 
^c,x a yb (@a 



7T/8A 

tt/4, 8 a 
3tt/8, 



tt/8) + 
tt/4) + 
I- 3tt/8) 



the rate, A p , of the correlated photon pairs for two differ- 
ent noise levels, i.e., the ratio between the mean rate of 
photons in the two channels. Far from ideal conditions, 
the presence of uncorrelated events in the two channels 
induces a non-linear increase of the QBER. The other 
parameters are set as in Fig. 3 for realistic PBSs param- 



eters, \t. 



0.99 and \tj 



0.025. 



where ((0 a , a + tt/2), (0 a + tt/8, 6 a + tt/8), (0 a + 7r/4,0 a + 
7r/4), (6 a + 37r/8, 8 a + 3tt / 8)) are angular settings gener- 
ating the key and f 'setting = 1/16. 

In a maximally entangled state configuration, the de- 
tectors contributing to the key should be l a l& and 2 a 2ft 
for the orthogonal analyzer settings and l a 2f> and 2 a lfc 
for the parallel settings. Thus the QBER is calculated 
according to 



QBER, 



chsh(^)- 4 ^ chsh ^^ I x c.x aVb (0 a ,6 a +TT/2)t+ Yl 



Xc,x a y b (°a +TT/S,6 a +TT/8) + 
Xc,x a y b (0a+Tr/4,9 a +TT/4) + 

Ac,s o » t (0a + 37r/M o + 37r/8) 



where the intuitive notation J2 Xa y b (x^ y ) indicates the cates the sum over l a l fo and 2 a 2 fc . 
sum over l a 2 b and 2 a l 6 detectors and Y JXa yb ( x=y) indi- 
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VI. SECURITY AND ERROR CORRECTION 



9^° ' 975 1 BB84 P roIOC °l 




CHSH/Ekerfs protocol 



FIG. 5: QBER in the case of CHSH and Wigner's inequal- 
ity based Ekert's protocols together with BB84 protocol ver- 
sus the angular analyzers settings 6 a and the entanglement 
parameter e. The parameters settings are A a = 2.8 10 6 



s ,a a = 0.25, \ b /\ a = 1.2, r) Xa = rj yb = 0.5, t x 



0.1, 



50 s , D a — D b = 100 ns, w — 4 ns and 



C = 1, taken from typical and experimental realistic values so 
far implemented. PBSs are considered real with \t z \ 2 = 0.99 

and \t±\ 2 = 0.025 (z = a,b). 



2. Ekert's protocol based on Wigner's inequality 

As in Ref. [7], wc consider the case of the Ekert's 
variant where the security of the quantum channels fol- 
lows from Wigner's inequality. In this case, Alice and 
Bob measure randomly among four analyzers settings 
whose choices are 9 a = (9 a — 77/6,6*0) for Alice and 
0b = (d a , d a + 7r/6) for Bob. The key distribution is 
performed when Alice's and Bob's settings are the same 
so that the sifted key is 

Ky/\(6 a ) — j setting ^ ^c,x a y b {^a, a )t, 



With f setting = 1/4. 

The QBER is calculated according to 



QBER WI (6' a )— f setting 



[A c ,l a l b (6 a , Og) + A c ^ 2a 2 b (6q, Qg)\ t 

K WI (6 a ) 



by taking the detectors contributing to the wrong bits as 
l a lfe and 2 a 2 b . 

In Fig. 5 we present a comparison of QBER levels for 
the BB84 protocol and the Ekert protocols considering 
both CHSH and Wigner's inequality versus the analyz- 
ers angular setting 6 a and the entanglement parameter 
e. Experimental conditions are the same (low noise) as 
for Figs. 3 and 4. Results highlight that the QBER is 
sensitive to the angle 9 a when the ideal entanglement is 
not achieved for both variants of Ekert's protocols. In 
the Wigner's case, the sensitivity is so remarkable that 
this protocol has to be considered less robust than BB84 
and the CHSH based Ekert's protocol. 



The security of the BB84 variant protocol is based on 
a public comparison between Alice and Bob's measure- 
ments on a sufficiently large random subset of the sifted 
key, e.g. more than half is recommended in [3]. 

The security proof for the CHSH-inequality-based Ek- 
ert's protocol is evaluated with the specific choices of 
settings by the CHSH inequality, 

S(0 a ) = E(8 a ,9 a +ir/8)-E(8 a ,9 a + 3ir/8) + 

E(8 a + tt/4, 6 a + tt/8) + E(9 a + tt/4, 9 a + 3tt/8), 

S'(8 a ) = E(8 a + tt/8, 9 a + tt/4) - E(9 a + tt/8, 9 a + tt/2) + 
E(8 a + 3tt/8, 9 a + tt/4) + E(8 a + 3tt/8, 9 a + tt/2), 

where we have 

E{8 ai 9 b ) = M lalb (9 a ,9 b )-M la2b (9 a ,9 b ) + 
M 2a2b (9 a ,9 b )-M 2alb (9 a ,9 b ). 



Here 



M. 



x aVb (O a ,Vb) 



^c,x a y b (9a, 0b) 



y b ^C,x a l 



,(0a,0 b ) 



is the normalized coincidence rate as a function of 
the analyzer settings and detector choices. The terms 
M XaVb (9 a , 0b) are commonly stored when experiments are 
performed. 

For maximally entangled states we have |5 q i| = S' ql 

2\/2, while for any realistic local theory we have \S, S'\ < 
2. It is expected that the presence of an eavesdropper will 
reduce the observed value of \S, S'\ , giving |5 eV e) S' evc \ < 
y/2, when the eavesdropper measures photons over either 
one or both (total eavesdropping) of Alice's and Bob's 
channels [2]. 

In the case of Wigner's-inequality-based Ekert's proto- 
col, the Wigner's inequality result has 

W(9 a ) = M lalb (9 a -ir/6,9 a ) + M lalb {9 a ,0 a + Tr/6) + 
-M lal6 ((9 a -7r/6A + 7r/6), 

giving for the maximally entangled states, W q i = — 1/8 
and W > for any local realistic theory. As for the 
CHSH inequality, it can be proved that the limit becomes 
W eve > 1/16 for Eve detecting only one photon of the 
pair, while in the case of total eavesdropping there is no 
boundary condition [37] . 

In Fig. 6 we compare the behaviors of 
the CHSH and Wigner's inequality parame- 
ters, S norm =(|5|-|5ev |)/(|Sqi|-|S , 0V0 |) and 

W„orm = (W - W eV e) / (Wql ~ Weve) , VerSUS the 

coincidence window w and the correlation level in Alice's 
channel, a a . The lower surfaces represent the case of 
real PBSs, where W n0 rm < S'norm, while the upper 
surface corresponds to ideal PBSs, where Wnorm = 
Snorm- We observe that, given the same noise level in 
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FIG. 6: The CHSH and Wigner's inequalities parameters 
Snorm and Wnorm versus the coincidence window w and the 
correlation level in the Alice channel a a . In the case of max- 



imally entangled states we have W n 



=S n 



=1, while the 



lower cut is defined by the eavesdropping limit W n0 rm < 
and Snorm < . The choice of parameter values are the same 
of Fig. 4 except for 9 a = and e = 0.95. The lower two sur- 
faces represented correspond to Wnorm and Snorm in the case 
of real PBSs, with parameters \t z \ = 0.98 and \tf\ — 0.05. 



The higher surface represents S n 
ideal PBSs. 



= W n 



in the case of 



the system and real PBSs, Wigner's parameter reaches 
the eavesdropping limit faster than the CHSH one does, 
revealing the intrinsic weakness of Wigner's test against 
experimental parameters. 

Furthermore, the Wigner's security test guarantees 
against eavesdropping strategies only for the detection 
of one photon of the pair, while the CHSH security is 
independent on the adopted strategy (see refs. [2, 37]). 

A satisfactory protocol must be able to recover from 
noise as well as from partial leakage, allowing Alice and 
Bob to reconcile the two strings of bits measured and dis- 
till from the sifted key a corrected key. A strong need for 
the application of any error-correction method is an a pri- 
ori knowledge of the QBER, which provides information 
regarding how many times the error-correction procedure 
must be applied to reduce the QBER to a certain agreed 
level, commonly 1 %. Here, we show an example of error 
correction on an a priori evaluated QBER according to a 
common approach reported in Ref. [7] , to show that our 
model allows for prediction of the corrected key length. 

In general, Alice and Bob cannot distinguish between 
errors caused either by an eavesdropper or by the en- 
vironment. Thus, they must assume that all errors are 
due to an eavesdropper and evaluate the leaked informa- 
tion from the QBER. Also, even though by the error- 
correction procedure one can disregard incorrect bits by 
simply dropping them off in building the distilled key, the 
residual knowledge of an eavesdropper may still not be 
faithfully quantified by the reduced QBER obtained af- 
ter the correction. The effects of Eve's strategy is in fact 
equivalent to quantum noise yielding eventually acciden- 
tal coincidences, these last contributing to both incorrect 



FIG. 7: QBER in the case of BB84 protocol versus the coin- 
cidence window w and the correlation parameter in the Alice 
channel a a : the sawtooth shape is due to the application of 
the error correction procedure. The parameters are set as in 
Figure 6 except that, in this case, ideal PBSs are considered. 



and correct bits transmitted, as it is clear from Eqs. (19, 
20). Hence the error-correction procedure is not suffi- 
cient to cancel a potential Eve's knowledge of part of the 
key due to accidental coincidence. 

To prove this last assertion we introduce the quantum 
accidental bit rate (QABR), a quantity related to acci- 
dental coincidences and, in this sense, analogous to the 
QBER. However, the error-correction procedure cannot 
reduce the QABR at the QBER level. As an example, 
we give the QABR in the case of Ekert's protocol based 
on Wigner's inequality, 

H AD % \ V a ) — J setting 77 TTTT • 

Figure 7 shows the QBER with and without the ap- 
plication of the error-correction procedure together with 
the 1/2 QABR vs the coincidence window and the corre- 
lation parameter in Alice's channel. The error-correction 
procedure is very ineffective at reducing the QABR and 
consequently the possible effect of Eve's knowledge on 
the corrected key. 



VII. CONCLUSIONS 

This paper is concerned with an a priori evaluation of 
QCKD crucial parameters when entangled photons pro- 
duced by SPDC are exploited. The basic experimental 
feature consists in the detection of coincident photons. 
Toward this aim, we developed a statistical model to 
calculate the probability of accidental coincidences con- 
tributing to errors in the sifted key, not completely ac- 
counted for by simple experimental means. 

We investigated the noise contribution due to imper- 
fect source generation and selection, imperfect polariz- 
ing beam splitters performing polarization states analy- 
sis, and noisy and lossy measurement system for photon- 
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number detection. We emphasized some basic system im- 
perfections such as uncorrelated photons collection, de- 
tection system deficiencies, detection system noise due 
to detector dark counts, and electronic system imperfec- 
tions associated with non-ideal-time-correlation measure- 
ments. 

We discussed how this model can be adopted for the 
evaluation of the QBER and the sifted key for different 
well-known protocols, i.e., BB84 and Ekert's protocols 
based on both CHSH and Wigner's inequality, and com- 
pared them to expected results. 

Given that this model predicts precisely the QBER and 
the sifted key, it ultimately guarantees a method to com- 
pare different security criteria of the hitherto proposed 
QCKD protocols and provides an objective assessment of 
performances and advantages of different systems. Thus, 
it yields a method for an a priori evaluation of the tol- 
erable experimental imperfections in a practically imple- 
mented quantum system to establish the degree of secu- 
rity and competitiveness of QCKD systems. 

Finally, we used the model in a standard error- 
correction procedure, observing that this does not com- 
pletely cancel the possible residual eavesdropping knowl- 
edge on the corrected key. We emphasize that this model 



yields also the degree of security of the corrected key, if 
a precise modelling of system imperfections is provided. 
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APPENDIX A: INTERACTION MATRIX U^. PBS 

We explicitly calculate the unitary transformation 
^V-pbs according to Eq.s (1) obtaining a 16x16 matrix 



i/>-PBS 



where we indicate 



/t/i u 2 u 3 u 4 \ 

U 2 Ux U 4 U 3 

U 3 U 4 U x U 2 

\U 4 u 3 u 2 uj 



J 



u x = 



u 3 



r a % 





K a T b 





















1 a 2 b 





n a T b ^ o 

Ki% 








/C a J b 



T a TZ b 



U 2 = 



u 4 


















/t-_Ltj_L 
1 a >H 



K a K b 

o n a n^ o o 
o o n^Ub o 
ooo n^nt 



r 



and % = t z /(t 2 z - r 2 z ), K z 
analogously for and 1Z Z . 



= r z /(t 2 z - r 2 ) (z 



a,b), According to Eq.s (2) and (18) we obtain for 

Pe a ,e b {x a ,yb) the following: 



P6 a ,e b 0-a, h) = 



1 + lei 



COS 



os 2 (0 a ) (|r a r^| 2 + |r/r h e| 2 ) + sin 2 (e a ) (|r a ^| 2 + \%%e\ 

os 2 (0 a ) (\T a T b \ 2 + |T a ^e| 2 ) + sm 2 (9 a ) [\T^%\ 2 + \T a T b ^e\ 
sin(2(9 )cos(2fl 6 )Re(eC/2) ( - \T a %\ 2 + \T a ^%\ 2 + \T a T b ^\ 2 - |T a ^| 2 ) 



P8 a ,8 b (la,2b) 



i + kl 



cos 2 (e b ) 

sm 2 (6 b ) 
sin 



cos 2 (0 a )(|T a ^| 2 + |r a ^ h e| 2 



cos 2 {9 a) (\T a n b 



(20 a )cos(2^)Rc(eC/2)(-|T a ^ b | 5 



sin 



sin 



0a) (\T a 
9a) (|^6 



^Kj-? + \T a K b ef 



\TJ-n h 



\ 2 a '^b I 
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Pe a ,e b (2 a ,l b ) 



i + kl 



' cos 2 (0 b ) [ cos 2 (9 a ) (\ll a T±\ 2 + |^T fc e| 2 ) + sin 2 (fl a ) (|^T^| 2 + |7e a T b e 
sin 2 (0 b ) ' cos\e a ) (\K a T b \ 2 + IKT^e] 2 ) + sm 2 (8 a ) (|^T b | 2 + |^ a T/ 
sin(2^)cos(2^)Re(eC/2) ( - \n a T b \ 2 + \K^T b \ 2 + \K a T b ^\ 2 - \R^\ 2 ) 



+ 



p 0afib (2 a ,2 b ) 



cos 2 (0 b ) 
sm 2 (6 b ) 



cos 2 (6 a ) ( l^^l 2 + |^ b e| 2 ) + sin 2 (0 a ) (|ft^| 2 + |ft a ft b e| 
cos 2 (tf a ) (|^ a ^ b | 2 + l^^ef) + sin 2 (fl a ) (|7^ b | 2 + |ft„ftJ- ( 



sin(2^)cos(2^)Re(eC/2) ( - |ft a ft b | 2 + |^ft b | 2 + |7e a ^| 2 - |7J^| 2 ) 



In the case of maximally entangled states, i.e. e = 
1 and C = 1, and ideal PBSs, i.e., \TZ Z \ = \TM = 



and YR-i 



\T Z \ = 1, the U^-vbs is simply given by 
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Uo = 





i 







u* = 



- 





























i 





.0 












Ua = 



0' 





1 



and 



and 



Pe a ,e b {l a ,h) = P0 aM (2 a ,2 b )=sm 2 (e a -9 b )/2(Al) 
Pe a ,e b 0-a,2b) = P0 a ,0„(2 a , h) = cos 2 (6 a - b )/2. 



APPENDIX B: DEAD-TIME CORRECTION 
DETERMINATION 

According to Refs. [36, 38], in the case of 
non-extending dead time, the correction is n z = 
1/(1 + TL z D z /t), where n z are the mean number 
of photons counted in the z channel, i.e. n z = 
J2x z =i z ,2 z J2k k Ptot,xA k ) witn Ptot,x z (k) calculated in 
the absence of dead time D z , and £ Xz — r\ x _.T x _,. We 
can therefore write down the dead time correction in this 
case as 



T,y b P( x a,yb) Vx a T Xa \- 



D„ 



TTfe 



J2x a p( x a,yb)vy b T Vb Xp 

,Vb 



D h 



by noting that, when several devices are used in series, 
a good approximation considers the whole apparatus to 
be a black box, with a non-extending dead time equal to 
the largest of dead times of the single component [36]. 
We showed in Ref. [38] that tt z provides a satisfactory 
approximation for t >> D z . 
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